cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42

Analysis

max time kernel
183s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:11

Target

cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe
Size

168KB
MD5

cc5a7db50d5d6f2ab939fa7e33c60109
SHA1

f0eb6345f998386c8fb3b7bfb20f89b6d6c7305d
SHA256

cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42
SHA512

aa309a61c7404a700f3a8be7515cbf9718e15d58de2b70437514aeb8dea6baac7cce464537d4525976344f11e1ddac0e88a7f9728c8c259b5391635e2a92511a
SSDEEP

1536:4uSPdV+tGlLDg12SrXv6LZriRkpdzjd6w47n3Y0+NYcO6TliNwWwXq0E5+hMizdh:5S7W+N8Zn5+hM0YWAxj25LR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3784 set thread context of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe
4676	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81
PID 3784 wrote to memory of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81
PID 3784 wrote to memory of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81
PID 3784 wrote to memory of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81
PID 3784 wrote to memory of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81
PID 3784 wrote to memory of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81
PID 3784 wrote to memory of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81
PID 3784 wrote to memory of 4676	3784	cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe	81

C:\Users\Admin\AppData\Local\Temp\cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe
"C:\Users\Admin\AppData\Local\Temp\cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Local\Temp\cb2876b6b9462804ae0b4cdb019843454c28aca933523df219b5a3c63a1b8e42.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4676

memory/3784-137-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4676-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4676-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download